154 lines
4.3 KiB
HCL
154 lines
4.3 KiB
HCL
locals {
|
|
tld = "fourlights.dev"
|
|
cluster_dns = "venus.${local.tld}"
|
|
domain = "zitadel.${local.cluster_dns}"
|
|
org_domain = "fourlights.${local.domain}"
|
|
}
|
|
|
|
module "zitadel_project" {
|
|
source = "../../../modules/zitadel/project"
|
|
|
|
org_id = var.org_id
|
|
name = var.name
|
|
owners = [var.user_id]
|
|
}
|
|
|
|
// TODO: add action for setting roles as scopes
|
|
|
|
module "zitadel_project_operator_roles" {
|
|
source = "../../../modules/zitadel/project/roles"
|
|
|
|
wait_on = [module.zitadel_project.installed]
|
|
org_id = var.org_id
|
|
project_id = module.zitadel_project.project_id
|
|
group = "Operator"
|
|
roles = [
|
|
"manage:profiles", "manage:contacts", "manage:addresses", "manage:enquiries", "manage:flowstates",
|
|
"manage:flowevents", "manage:files"
|
|
]
|
|
}
|
|
|
|
module "zitadel_project_configurator_roles" {
|
|
source = "../../../modules/zitadel/project/roles"
|
|
wait_on = [module.zitadel_project_operator_roles.installed]
|
|
|
|
org_id = var.org_id
|
|
project_id = module.zitadel_project.project_id
|
|
group = "Configurator"
|
|
roles = [
|
|
"manage:brands", "manage:flows"
|
|
]
|
|
}
|
|
|
|
module "zitadel_project_developer_roles" {
|
|
source = "../../../modules/zitadel/project/roles"
|
|
wait_on = [module.zitadel_project_configurator_roles.installed]
|
|
|
|
org_id = var.org_id
|
|
project_id = module.zitadel_project.project_id
|
|
group = "Developer"
|
|
roles = [
|
|
"manage:jobs", "manage:infrastructure"
|
|
]
|
|
}
|
|
|
|
module "zitadel_project_user_grant" {
|
|
source = "../../../modules/zitadel/project/user-grant"
|
|
wait_on = [module.zitadel_project_developer_roles.installed]
|
|
org_id = var.org_id
|
|
project_id = module.zitadel_project.project_id
|
|
user_id = var.user_id
|
|
roles = concat(module.zitadel_project_developer_roles.roles, module.zitadel_project_configurator_roles.roles, module.zitadel_project_operator_roles.roles)
|
|
}
|
|
|
|
// TODO: Move External (and 365zon Push service account) to own project
|
|
// TODO: Add grant for external project
|
|
// TODO: Add read roles
|
|
|
|
module "zitadel_project_application_core" {
|
|
source = "../../../modules/zitadel/api-m2m-swagger"
|
|
wait_on = [module.zitadel_project_user_grant.installed]
|
|
|
|
org_id = var.org_id
|
|
project_id = module.zitadel_project.project_id
|
|
|
|
name = "Core"
|
|
zitadel_domain = local.domain
|
|
cluster_domain = local.cluster_dns
|
|
|
|
namespace = var.namespace
|
|
project = var.name
|
|
|
|
service_account = false
|
|
roles = []
|
|
}
|
|
|
|
module "zitadel_project_application_salesforce" {
|
|
source = "../../../modules/zitadel/api-m2m-swagger"
|
|
wait_on = [module.zitadel_project_application_core.installed]
|
|
|
|
org_id = var.org_id
|
|
project_id = module.zitadel_project.project_id
|
|
|
|
name = "Salesforce"
|
|
zitadel_domain = local.domain
|
|
cluster_domain = local.cluster_dns
|
|
|
|
namespace = var.namespace
|
|
project = var.name
|
|
|
|
roles = module.zitadel_project_operator_roles.roles
|
|
}
|
|
|
|
module "zitadel_project_application_external" {
|
|
source = "../../../modules/zitadel/api-m2m-swagger"
|
|
wait_on = [module.zitadel_project_application_salesforce.installed]
|
|
|
|
org_id = var.org_id
|
|
project_id = module.zitadel_project.project_id
|
|
|
|
name = "External"
|
|
zitadel_domain = local.domain
|
|
cluster_domain = local.cluster_dns
|
|
|
|
namespace = var.namespace
|
|
project = var.name
|
|
|
|
roles = module.zitadel_project_operator_roles.roles
|
|
}
|
|
|
|
module "zitadel_project_application_module_internal" {
|
|
source = "../../../modules/zitadel/api-m2m-swagger"
|
|
wait_on = [module.zitadel_project_application_external.installed]
|
|
|
|
org_id = var.org_id
|
|
project_id = module.zitadel_project.project_id
|
|
|
|
name = "Internal"
|
|
zitadel_domain = local.domain
|
|
cluster_domain = local.cluster_dns
|
|
|
|
namespace = var.namespace
|
|
project = var.name
|
|
|
|
roles = module.zitadel_project_operator_roles.roles
|
|
}
|
|
|
|
// TODO: Application for Front-End End (implicit, authorization_code, refresh_token)
|
|
// TODO: Update API applications with callback apiDomain/swagger/oauth2-redirect.html to allow logging in for swagger (and probably hangire?)
|
|
// TODO: Put all the relevant secrets into secret manager
|
|
// TODO: Set up opentelemetry and update appinsights shit to use that.
|
|
|
|
output "org_id" {
|
|
value = var.org_id
|
|
}
|
|
|
|
output "project_id" {
|
|
value = module.zitadel_project.project_id
|
|
}
|
|
|
|
output "installed" {
|
|
value = true
|
|
depends_on = [module.zitadel_project_application_external.installed]
|
|
}
|